CVE-2024-50354 json
Out-of-memory during deserialization with crafted inputs
published 2024-10-31 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-3021 , GHSA-cph5-3pgr-c82g , GO-2024-3244
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.
Patch / fix
- go github.com/consensys/gnark 0.11.1, 0.12.0
- govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20250207T224745-150000.1.32.1
- govulncheck-vulndb SLE Module for Package Hub 15 SP6, SLE Module for Package Hub 15 SP5, openSUSE Leap 15.6 +1 more 0.0.20241104T154416-150000.1.12.1
suse advisories SUSE-SU-2025:0429-1SUSE-SU-2024:3950-1
- govulncheck-vulndb Package Hub 12 0.0.20241104T154416-5.1
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20241101T215616-1.1
opensuse advisories openSUSE-SU-2024:0350-1openSUSE-SU-2024:14452-1
- github.com/Consensys/gnark@47ae846 commit
- github.com/Consensys/gnark#1307 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/Consensys/gnark/security/advisories/GHSA-cph5-3pgr-c82g referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/consensys/gnark | <0.11.1 <0.12.0 |
0.11.1 0.12.0 |
Affected products
- Consensys gnark
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/Consensys/gnark/pull/1307
web, issue-tracking, patch
-
github.com
/Consensys/gnark/commit/47ae846339add2bdf9983e499342bfdfe195191d
web, patch
-
github.com
/Consensys/gnark/security/advisories/GHSA-cph5-3pgr-c82g
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-50354
advisory
-
github.com
/Consensys/gnark
package
-
github.com
/advisories/GHSA-cph5-3pgr-c82g
advisory
Sources
- CVE List CVE-2024-50354
- GitHub Advisory GHSA-cph5-3pgr-c82g
- NVD CVE-2024-50354
- OSV GO-2024-3244
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.